CVE-2024-7052
📋 TL;DR
This vulnerability allows administrators in WordPress multisite installations to inject malicious scripts into Forminator Forms plugin settings. The stored XSS payload executes when other users view the affected settings pages, bypassing WordPress's unfiltered_html security restriction.
💻 Affected Systems
- Forminator Forms WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Administrator account compromise leading to full site takeover, data theft, or malware distribution to visitors.
Likely Case
Privileged user account hijacking, session theft, or unauthorized actions performed by compromised admin accounts.
If Mitigated
Limited impact with proper user privilege management and content security policies in place.
🎯 Exploit Status
Exploitation requires admin-level access. Public proof-of-concept available through WPScan.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.38.3
Vendor Advisory: https://wpscan.com/vulnerability/4e52cab5-821c-4ca8-9024-67f716cf78fe/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Forminator Forms plugin. 4. Click 'Update Now' if available. 5. Alternatively, download version 1.38.3+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Temporary Plugin Deactivation
allDisable Forminator Forms plugin until patched
wp plugin deactivate forminator
Restrict Admin Access
allTemporarily limit administrator accounts to trusted users only
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution
- Enable WordPress security plugins with XSS protection features
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin → Plugins → Forminator FormsCheck Version:
wp plugin get forminator --field=versionVerify Fix Applied:
Confirm plugin version is 1.38.3 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual admin activity modifying form settings
- JavaScript payloads in form configuration data
Network Indicators:
- Suspicious script tags in form submission endpoints
SIEM Query:
source="wordpress" AND (event="plugin_update" OR event="settings_change") AND plugin="forminator" AND version<"1.38.3"